fix for python api bug: assigning the wrong size array to an RNA property wasn't checking the length and could crash, eg:

  mesh.polygons[0].vertices = (10,)

1 files changed, 12 insertions, 5 deletions

diff --git a/source/blender/python/intern/bpy_rna_array.c b/source/blender/python/intern/bpy_rna_array.c
index ba01b789e54..ee5f6109ab8 100644
--- a/source/blender/python/intern/bpy_rna_array.c
+++ b/source/blender/python/intern/bpy_rna_array.c
@@ -74,13 +74,14 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
 	/* not the last dimension */
 	if (dim + 1 < totdim) {
 		/* check that a sequence contains dimsize[dim] items */
-		const Py_ssize_t seq_size = PySequence_Size(seq);
+		const int seq_size = PySequence_Size(seq);
 		if (seq_size == -1) {
 			PyErr_Format(PyExc_ValueError, "%s sequence expected at dimension %d, not '%s'",
 			             error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
 			return -1;
 		}
 		for (i = 0; i < seq_size; i++) {
+			Py_ssize_t item_seq_size;
 			PyObject *item;
 			int ok = 1;
 			item = PySequence_GetItem(seq, i);
@@ -90,7 +91,7 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
 				             error_prefix, Py_TYPE(seq)->tp_name, i);
 				ok = 0;
 			}
-			else if (!PySequence_Check(item)) {
+			else if ((item_seq_size = PySequence_Size(item)) == -1) {
 				/* BLI_snprintf(error_str, error_str_size, "expected a sequence of %s", item_type_str); */
 				PyErr_Format(PyExc_TypeError, "%s expected a sequence of %s, not %s",
 				             error_prefix, item_type_str, Py_TYPE(item)->tp_name);
@@ -101,12 +102,12 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
 			 * dimsize[2] = 5
 			 *
 			 * dim = 0 */
-			else if (PySequence_Size(item) != dimsize[dim + 1]) {
+			else if (item_seq_size != dimsize[dim + 1]) {
 				/* BLI_snprintf(error_str, error_str_size,
 				 *              "sequences of dimension %d should contain %d items",
 				 *              dim + 1, dimsize[dim + 1]); */
-				PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items",
-				             error_prefix, dim + 1, dimsize[dim + 1]);
+				PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
+				             error_prefix, dim + 1, dimsize[dim + 1], item_seq_size);
 				ok = 0;
 			}
 			else if (validate_array_type(item, dim + 1, totdim, dimsize, check_item_type, item_type_str, error_prefix) == -1) {
@@ -128,6 +129,12 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
 			             error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
 			return -1;
 		}
+		else if (seq_size != dimsize[dim]) {
+			PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
+			             error_prefix, dim, dimsize[dim], seq_size);
+			return -1;
+		}
+
 		for (i = 0; i < seq_size; i++) {
 			PyObject *item = PySequence_GetItem(seq, i);